Davide Silvetti

قد تستخدم صور الأجهزة الافتراضية (VM) التي تم إنشاؤها باستخدام Kubernetes Image Builder Nutanix أو مزودي OVA بيانات اعتماد افتراضية لصور Windows في حالة عدم قيام المستخدم بالكتابة فوقها.

The issue arises from improper sanitization of user input before it is used in a SQL statement, leading to a SQL Injection in the `CompanyDetails` operation of the `MailManager` module.

The issue concerns incorrect user privilege checking, allowing a low-privileged user to interact directly with the "Migration" administrative module. This enables the user to disable arbitrary modules.

The issue is related to a path-traversal vulnerability in the session handling code of pgAdmin, which can lead to unsafe deserialization and remote code execution. This vulnerability can be exploited by an unauthenticated attacker on Windows or an authenticated attacker on POSIX/Linux systems, allowing them to gain code execution. The vulnerability is associated with the incorrect serialization of the `pga4 session` cookie file.